91–100 of 141 posts
Earlier quoted context omitted.
People are trying to secretly fix bugs?
Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.
Earlier quoted context omitted.
Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.
Ah, I guess that would advertise that users of the old version are vulnerable. I was imagining some altruistic contributor trying to sneak in a bug fix past the maintainer.
This describes my life as an open source maintainer at the moment! In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review. The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of so…
Earlier quoted context omitted.
Have you heard of these things called LLMs are that are quite good at reversing changes in closed source binaries?
you can diff binaries in a disassembler, the technique has been used for a long time to discover patched Microsoft vulnerabilities, create exploits and then race the world. now you can instruct an LLM to do this with MCP...
Earlier quoted context omitted.
you can diff binaries in a disassembler, the technique has been used for a long time to discover patched Microsoft vulnerabilities, create exploits and then race the world. now you can instruct an LLM to do this with MCP...
There are many techniques for making a closed-source binary harder to reverse engineer: polymorphism, symbol stripping, code encryption, packing, and so on. Closed-source binaries at least stand a chance of being effectively obfuscated, unlike open-source code.
now none of those methods matter as you can just instruct an LLM to bang its head against the wall until the wall breaks.
Earlier quoted context omitted.
I came across rclone at work because "Copy or move data to Azure Storage by using AzCopy v10" is a lie, it literally can't `move` files, only `copy` them. I can't express in polite words how pathetic it is to see the only official blob storage bulk transfer CLI tool from a multi-trillion-dollar company fail to do the simplest, most essential functionality after ten major revisions. Meanwhile, rclone Just Works(tm). T…
Do not try and move the files; that's impossible. Instead, only try to realize the truth... Delete them after you copy.
Earlier quoted context omitted.
I came across rclone at work because "Copy or move data to Azure Storage by using AzCopy v10" is a lie, it literally can't `move` files, only `copy` them. I can't express in polite words how pathetic it is to see the only official blob storage bulk transfer CLI tool from a multi-trillion-dollar company fail to do the simplest, most essential functionality after ten major revisions. Meanwhile, rclone Just Works(tm). T…
Do not try and move the files; that's impossible. Instead, only try to realize the truth... Delete them after you copy.
This describes my life as an open source maintainer at the moment! In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review. The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of so…
> GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn't ideal. A strange bottleneck; anyone know why that would be so slow?